2

I use ssh to log into many servers.

When running a script that does this, ssh-agent uses 100% CPU time. For small tasks on many servers ssh-agent is now the bottleneck.

Is there anything I can do to speed up ssh-agent? Can it be told to fork off a worker to do the heavy lifting? I have plenty of other cores.

Ole Tange
  • 35,514
  • Have you set ControlMaster and ControlPersist in your .ssh? – nycynik Apr 02 '17 at 16:08
  • Would that not require the connection to be to the same host? It is not many connections to one host. It one connection to many different hosts. – Ole Tange Apr 02 '17 at 16:23

1 Answers1

1

No. ssh-agent does not have possibility to work in parallel. It handles all request sequentially, which might cause a lot of CPU cycles when doing a lot of signatures.

You didn't mention what key types and sizes you are using. You can achieve some difference in performance by using different key types (ECDSA, ED25519, ...) or smaller RSA sizes.

If you don't have passphrase on the key(s), you can leave the ssh-agent out and the signatures can be simply performed by the ssh itself (though it potentially degrades security).

As already mentioned int he comments, you can speed up some things using ControlMaster (in case you issue many connections to the same server).

Last I can think of would be running multiple ssh-agents to distribute the load (probably in different shells), but it is also kind of ugly workaround.

Jakuje
  • 21,357